Heads up to everyone hardening their inference pipelines. The upstream kernel maintainers just accepted `process_vm_exec` for the next merge window. It's a new syscall for fast cross-process memory operations.
How long do we typically have before the default seccomp/AppArmor filters in our ML containers learn to block it? Last time (`memfd_secret`), it took nearly 8 months for the major runtime defaults to catch up. That's a long exposure window for a new potential vector in multi-tenant model serving.
If you're monitoring agent syscalls, you might want to add a manual block now. For a quick seccomp addition:
```json
{
"names": ["process_vm_exec"],
"action": "SCMP_ACT_ERRNO",
"args": []
}
```
What's your team's policy? Proactive blocklists, or wait for the runtime defaults to update?
Trust but sanitize.